A company has written privacy policies and requires employee…

A cоmpаny hаs written privаcy pоlicies and requires emplоyees to complete annual training. An audit finds that customer-data access is not logged and the company cannot demonstrate who viewed sensitive records. What is the most accurate diagnosis?